How to prevent deleting Tags from users in repository

I have a repository in which i have created multiple tags. my CI/CD using based on tag release approach. So i want to restrict the users not to delete the tags from repository. How to prevent users?

Anyone with write access to a repository can push any tag and delete any existing tag. There is no way to prevent that, short of removing their write access.

Sounds like you should consider doing your CI in a separate repository so that the one people fork from doesn’t have so many.

If you’re really insistent on keeping tags in certain places, you could have a workflow which responds to tags being deleted by cross checking against a second copy of the repository, and if they’re deletes of tags you care about, put them back:

on:
  delete:

Or similarly.


You could also ask everyone (including your members) to switch to a fork model instead of letting some people maintain branches in your main repository. That should generally protect you from the problems you’re running into.


Personally, I have a script called empty-remote. The first thing I do after forking a repository in GitHub is run it on my fork before cloning. Then I clone, so that I only get a single branch and not every release since the beginning of time. (And yes, I could use --single-branch, but I don’t want my fork to show all that stuff, it’s just a distraction and makes it harder for me to figure out which branches are interesting when I return to my fork in a year. And yes, I could only look at “my branches”, but it’s still silly.)

Is there any other option like restrict thru hooks? but not sure how it works.
what is the work around you did in your project?